- CHANGELOG.md and CHANGELOG.pt-BR.md, from the project history.
- .env.example now serves development and production; scripts/init-env.sh
(make env) creates .env with random secrets. .env.production.example is gone.
- docs/RELEASING.md: the pipeline, how a version is cut and deployed, the runners.
- DEPLOYMENT.md and both READMEs updated for Gitea and the new env flow.
- Service versions set to 1.0.0.
- CI: the proxy network step is idempotent and the stack is torn down always,
since the runner's Docker daemon now outlives a job.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The Release workflow only ever published container images; there was no entry
under Releases. The new job runs after every image is published and writes the
image list and the commit log since the previous tag.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
npm and Go module caches, the embedded Postgres binaries, Trivy's database, and
the daemon's own layer cache for image builds. The webmail Next build is no
longer run a second time outside the Dockerfile.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The job workspace is a volume the DinD daemon cannot see, so migrations and the
Trivy filesystem scan now docker cp their inputs. Trivy's image gate flagged
next 15.5.27 (unauthenticated RCE in image optimisation, fixed in 15.5.28) and
go-jose 4.1.4 (DoS, fixed in 4.1.6); both are patch bumps.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
aquasecurity/trivy-action clones the Trivy repository from the workflow's own
server, which on Gitea is not GitHub. The gha buildx cache has no Gitea
counterpart.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Release now pushes to git.lucasrguerra.dev.br instead of ghcr.io, tags each
architecture separately (no artifact upload, no gha cache) and joins them with
imagetools. GITHUB_OUTPUT and GITHUB_STEP_SUMMARY stay: they are the runner's
own interface and the GITEA_* equivalents are not set.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Release now pushes to git.lucasrguerra.dev.br instead of ghcr.io, tags each
architecture separately (no artifact upload, no gha cache) and joins them with
imagetools. Workflows live in .gitea/workflows and use the gitea context.
GITHUB_OUTPUT and GITHUB_STEP_SUMMARY stay: they are the runner's own interface.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
